Hey guys, I found something interesting in attempting to deploy OSSEC in agent/ server model. Not sure what the implications are here, but it seems like 1514 isn't the only port OSSEC retains communication over (since it's UDP I think?).
The firewall rules that I'm working with are very restrictive. And UDP is also restricted. I requested that 1514 UDP be opened on both the server and agents but still couldn't get OSSEC to communicate between the agents/servers. After running a tcpdump, I found this: 18:24:49.215025 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 93) 10.x.x.x.1514 > 216.x.x.x.43591: UDP, length 65 So it seems the server was sending a request to the destination where the destination port is dynamic. Is there something I'm missing here?
